Hacker News new | ask | show | jobs
by djjaxe 4602 days ago
Well it would be nice if google could check the url it was visiting and if there is any sqli in it to not send the request (though this could potentially slow their crawling...)
2 comments

How is Google supposed to check for what is/isn't "sqli"? The proposal reminds me of Yahoo! Mail's old "medireview" problem, where it filtered emails containing the string "eval":

http://en.wikipedia.org/wiki/Medireview#Blocked_emails

Even if you look for somewhat complete SQL strings, if I want to host http://try-sql-in-your-browser.io/?sql=select+foo+from+bar, I'd want Google to index it.

Well for one, we could make a standard query value that would say whether or not, the URL is evil.

http://try-sql-in-your-browser.io/?evil=true

It works well for IPv4.

For a hilarious variant trying to protect against "attacks" on humans, use your favorite search engine to search for "buttbuttination".
Awesome, I had seen a few things in the wild like this, but this ended up in some fun reading. Thanks!
Why? Do you want anybody but Google to hack your site? Why would Google spend resources on unnecessary detection of SQL injection(which probably will not be perfect anyway and may break legit requests) when anybody can hack your website?

I just can't justify why do you expect Google to spend resources on not running bogus HTTP GET request when anybody can run those? What is different about being hacked by Google bot and being hacked by an unsuspected user who clicks on a bogus link that was put on the same page where Google found that link to your server? Just doesn't makes sense.

> Just doesn't makes sense.

Not only that, but it seems to me that it'd be a more efficient use of resources to spend the time hardening your own site rather than lobbying Google to implement something that only mitigates one potential attack vector. Even then, it just seems stupid because I'm sure there are valid GET query strings that might have select, insert, update, delete, or some permutation thereof in them.

It seems to me that it's just a punt on poor programming habits...